Monitor Windows via WMI from Cacti on Linux

[chrisru]

Hi Claymen,

Sorry about that. No wonder I was having issues I've managed to combine the two projects in my mind as one. So I have completely removed the plugin and running nicely on your script. Thanks for clearing that up for me and thanks for the script.

Chris

[antifaction]

Anyone has any luck getting this to work on windows 2008 server? They seemed to change the way to call the classes and such?

Anyone have any examples of how to get this to work on 2008?

[maltyx]

First of all I would like to thank for great templates to Claymen.
It was really helpful for me .. but ..
There are some things I still can't to solve.
Still can't get to plot some graphs, like Exchange database perfomance, Active client count, Client RPC latency, Total mailbox items ..

My environment: Cacti 0.8.7b on Ubuntu Hardy Linux
WMI Templates 0.0.6
wmic Version 4.0.0tp4-SVN-build-UNKNOWN
Apache, SNMP and PHP - latest version availible through apt-get

With Memory Usage Grpagh I finally figured the the problem was with CDEF, but for other graphs there is no any CDEF value in it ...

Poller Cache for Database Perfomance is the follow:

Code: Select all

  Script: /usr/bin/php -q /usr/share/cacti/site/scripts/wmi.php -h '10.16.16.112' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox' -n '' -k 'Name' -v '' -c 'ActiveClientLogons,MessagesDelivered,MessagesSent,MessagesSubmitted,ReceiveQueueSize,SendQueueSize,TotalCountofRecoverableItems,TotalSizeofRecoverableItems'  
 RRD: /var/lib/cacti/rra/muni2-server_recvqueue_527.rrd  

Any Ideas what is my problem is? I am new to CACTI - so I am apologize for any stupid question ..
Thanx

[claymen]

@antifaction
I've had no issues using it on 2008. Worked the same as 2003, the only difference was a couple WMI classes were renamed or didn't contain the same data.

@maltyx

Does that WMI class Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox even exist? Like if you install ScriptOMatic2 on the machine and get it to query that class, does it return any data at all?

What happens when you run that command directly from the console on the server?

[maltyx]

to Claymen:
from console it returns the follows:

Code: Select all

NTSTATUS: NT code 0xc0041017 - NT code 0xc0041017


Return code non-zero, debug mode enabled!



/usr/bin/wmic --namespace='root\CIMV2' --authentication-file=/etc/cacti/cactiwmi.pw //10.16.16.112 "SELECT ActiveClientLogons,MessagesDelivered,MessagesSent,MessagesSubmitted,ReceiveQueueSize,SendQueueSize,TotalCountofRecoverableItems,TotalSizeofRecoverableItems FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox WHERE Name="
Exec Status: 1

Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox - does exist on the target server (by scriptomatic) .. and script-query on this WMI class from scriptomatic does not return any data ..
Well after restartin WMI ans Exchange Management services - scriptomatic do return data from Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox class .. but the CACTI script still saying:

Code: Select all

NTSTATUS: NT code 0xc0041017 - NT code 0xc0041017


Return code non-zero, debug mode enabled!

[maltyx]

strange, after removing "-k Name" from the query script - it did work ..
should I disable the filter option in the template?

----
Update: still can't fix the following Exchange 2003 Graphs:
1. Active Clients Logon - no Image, just X insted
2. Database Performance displays NAN entries, but script from console works fine ..
3. Total Mailbox Items displays NAN and also returns 0xc0041017 error code from the console (scriptomatic can query WMI class Exchange_Mailbox' in WMI 'root\MicrosoftExchangeV2
Two days I am digging this forum and still no success - Please advise!

[claymen]

strange, after removing "-k Name" from the query script - it did work ..
should I disable the filter option in the template?

----
Update: still can't fix the following Exchange 2003 Graphs:
1. Active Clients Logon - no Image, just X insted
2. Database Performance displays NAN entries, but script from console works fine ..
3. Total Mailbox Items displays NAN and also returns 0xc0041017 error code from the console (scriptomatic can query WMI class Exchange_Mailbox' in WMI 'root\MicrosoftExchangeV2
Two days I am digging this forum and still no success - Please advise!

-k is your filter key, without it lots of things won't work. Basically its the logic of if <filter key> = <filter value> return matching results.

1. Not sure could be many things, cacti logging would tell more
2. Are you testing the script as the cacti user itself, remember the cacti poller runs under its own user. Generally if its working from console it should from cacti. It's also worth checking your cacti log to see if its actually getting data from the script? If so it could be your CDEF's being munged due to using maybe a newer version than what I developed the scripts on.
3. This one is a bit weird, when testing with scriptomatic was it running as the user defined in your cacti-wmi.pw file? Also have you tried a query directly with wmic, you should be able to enable debug on wmi.php to print out the full wmic call and run that manually with -d2 etc to find out at what stage its failing.

Is your service account your using to do these querys a local admin on the destination machines?

[maltyx]

-k is your filter key, without it lots of things won't work. Basically its the logic of if <filter key> = <filter value> return matching results.

could you give an example of using that kind of filter in your templates?

1. Not sure could be many things, cacti logging would tell more

the only log for this host I found is log for Mailbox Stats

10/08/2009 07:30:14 PM - CMDPHP: Poller[0] Host[41] DS[530] WARNING: Result from CMD not valid. Partial Result:

Bu after editing Graph template for Active Client Logons, there were 6 fields empty in graph template data, for Database 1 to 5 and Total - and from drop-downs I have made selection for Exchange 2003 - Database Perfomance (ActiveClient logons) - and the Cacti start to draw this graph with NANs for all databases.
By the way - what those Databases stand for? and should I do I have done with this graph template?

2. Are you testing the script as the cacti user itself, remember the cacti poller runs under its own user. Generally if its working from console it should from cacti. It's also worth checking your cacti log to see if its actually getting data from the script? If so it could be your CDEF's being munged due to using maybe a newer version than what I developed the scripts on.

my CACTI version is 0.8.7b
I did not find any specific user for CACTI on my Ubuntu box .. at least in cat /etc/passw output... it seems that cacti poller cmd.php runs under www-data user (like Apache2)

I ran all scripts without sudo, just copy and past in putty window.
And wich CDEF associated with Database Perfomance - Trending - 30 min?

Is your service account your using to do these querys a local admin on the destination machines?

Yes, it is in Domain admin group.

[maltyx]

3. This one is a bit weird, when testing with scriptomatic was it running as the user defined in your cacti-wmi.pw file? Also have you tried a query directly with wmic, you should be able to enable debug on wmi.php to print out the full wmic call and run that manually with -d2 etc to find out at what stage its failing.

No scriptomatic I ran on the exchange server itself with local Admin, but the query user is a Domain Admin also.
the following is output of wmic -d2 key ..for mailbox stats

Code: Select all

wmic --namespace='root\MicrosoftExchangeV2' --authentication-file=/etc/cacti/cactiwmi.pw //10.16.16.112 "SELECT Size,TotalItems,DeletedMessageSizeExtended FROM Exchange_Mailbox WHERE MailboxDisplayName=" -d2
lp_load: refreshing parameters from /dev/null
gensec subsystem fake_gssapi_krb5 is disabled
gensec subsystem gssapi_spnego is disabled
Mapped to DCERPC endpoint 135
Cannot do GSSAPI to an IP address
Failed to start GENSEC client mech gssapi_krb5: NT_STATUS_INVALID_PARAMETER
OK   : dcom_create_object.
OK   : Create remote WMI object.
lib/com/dcom/main.c:441: dcom_get_pipe: host=10.16.16.112, similar=10.16.16.112[49622]
Successfully connected to OXID b7e304f00000000b
OK   : Login to remote object.
OK   : Login to remote object.
OK   : WMI query execute.
OK   : Reset result of WMI query.
OK   : dcom_query_interface.
OK   : Retrieve enumerator of result(IWbemFetchSmartEnum).
OK   : Retrieve enumerator of result(IWbemWCOSmartEnum).
ERROR: IWbemWCOSmartEnum_Next. - WBEM_E_INVALID_QUERY
ERROR: Retrieve result data.
NTSTATUS: NT code 0xc0041017 - NT code 0xc0041017

[claymen]

Code: Select all

wmic --namespace='root\MicrosoftExchangeV2' --authentication-file=/etc/cacti/cactiwmi.pw //10.16.16.112 "SELECT Size,TotalItems,DeletedMessageSizeExtended FROM Exchange_Mailbox WHERE MailboxDisplayName=" -d2

ERROR: IWbemWCOSmartEnum_Next. - WBEM_E_INVALID_QUERY
ERROR: Retrieve result data.
NTSTATUS: NT code 0xc0041017 - NT code 0xc0041017

This is why you need -k
"SELECT Size,TotalItems,DeletedMessageSizeExtended FROM Exchange_Mailbox WHERE MailboxDisplayName="

Without -k the where section will not work. The query works like SQL. Select rows from database where column = something. In this case you tried to query for mailbox info using a MailboxDisplayName equal to nothing.

Active client logons is a basic template that you need to customize to suit your needs. If you want to test with it use _Total so that it reports the total of all logons across the server. It also from memory uses information pulled in from another data source.

Can you execute the script running as www-data then? What I am trying to work out is whether cacti can call the script as the user its being run as, whilst it may work as yours if permissions are wrong on the linux box then it won't run as the cacti user. Ive seen a few people install the script but set the permissions on the password file wrong etc which would also give you some odd results because cacti can run the script but the script can't read the password file.

[maltyx]

This is why you need -k
"SELECT Size,TotalItems,DeletedMessageSizeExtended FROM Exchange_Mailbox WHERE MailboxDisplayName="

Without -k the where section will not work. The query works like SQL. Select rows from database where column = something. In this case you tried to query for mailbox info using a MailboxDisplayName equal to nothing.

Thank you for explanation - I did not get at the begining that this template can be accosiated only with one mailbox, or there is a possibility to use a wildcard? I thought it can display items information about all mailboxes on datastore ... well now after applying specific Mailbox Name filter it works.

Active client logons is a basic template that you need to customize to suit your needs. If you want to test with it use _Total so that it reports the total of all logons across the server. It also from memory uses information pulled in from another data source.

Now I am trying to activate this one with applying Name of specific exchange datatstore or just _Total value.
The only thing I still did not understand is why Active Logon graph is not working until I set a value in all 6 drop-downs for all Databases from 1 to 5 and total - what happens if I have only 2 exchange DB? Or should I just delete the extra Database fields?

Can you execute the script running as www-data then? What I am trying to work out is whether cacti can call the script as the user its being run as, whilst it may work as yours if permissions are wrong on the linux box then it won't run as the cacti user. Ive seen a few people install the script but set the permissions on the password file wrong etc which would also give you some odd results because cacti can run the script but the script can't read the password file.

the password file is readable by www-data user, the only fix a did is CHOWN for www-data for /var/log/cacti/wmi directory.

And - again - thank you claymen for your help!

[claymen]

It can be associated with multiple mailboxes but you need to create the graph with the template then set the graph to have no template so that you can custom edit it. There is no way to auto generate that style of graph without using a data query which I havent had the time to do. I hacked around with it but in the end for the work required it wasn't worth it at my last workplace.

What you need to do is generate the data sources for each of the databases/mailbox stores/whatever you want to monitor then use that temlate and add in each one you want. It's more of a guide that template than one to use strictly as a cacti template if that makes sense. What I meant by using _Total was just a simple way to get some data as _Total usually always works and works around any spelling mistakes in your database names etc.

So is cacti getting any data back when running the script? If you put cacti into high log level mode and look at the cacti.log does the script return data back? I guess what im looking for is it getting anything at all, is it a problem wmi.php -> cacti or else where.

[maltyx]

Well, after applying filters all Exchange graphs start to work, just need to tweak Active Logons template for my exchange DBs instead of _Total and I hope it will be fine.
Thank You, Claymen for your time and generous help!

[JorisFRST]

Get this in the log, but rrd file is not created ??

10/12/2009 05:00:07 PM - POLLER: Poller[0] CACTI2RRD: /usr/bin/rrdtool update /var/www/cacti/rra/hers2004_readbytespersec_1388.rrd --template QueueLength:ReadBytesPersec:ReadsPersec:WriteBytesPersec:WritesPersec N:0:5856099328:405102:11258483712:493841
10/12/2009 05:00:07 PM - POLLER: Poller[0] CACTI2RRD: /usr/bin/rrdtool create /var/www/cacti/rra/hers2004_readbytespersec_1388.rrd --step 300 DS:ReadBytesPersec:COUNTER:600:0:100000000000000000 DS:WritesPersec:COUNTER:600:0:100000000000 DS:ReadsPersec:COUNTER:600:0:100000000000 DS:QueueLength:GAUGE:600:0:10000 DS:FreeSpace_Base:GAUGE:600:0:10000000 DS:FreeSpace:GAUGE:600:0:10000000 DS:WriteBytesPersec:COUNTER:600:0:100000000000000000 DS:WriteBytesPersec:COUNTER:600:0:100000000000000000 DS:ReadBytesPersec:COUNTER:600:0:100000000000000000 RRA:AVERAGE:0.5:1:500 RRA:AVERAGE:0.5:1:600 RRA:AVERAGE:0.5:6:700 RRA:AVERAGE:0.5:24:775 RRA:AVERAGE:0.5:288:797 RRA:MIN:0.5:1:600 RRA:MIN:0.5:6:700 RRA:MIN:0.5:24:775 RRA:MIN:0.5:288:797 RRA:MAX:0.5:1:500 RRA:MAX:0.5:1:600 RRA:MAX:0.5:6:700 RRA:MAX:0.5:24:775 RRA:MAX:0.5:288:797 RRA:LAST:0.5:1:600 RRA:LAST:0.5:6:700 RRA:LAST:0.5:24:775 RRA:LAST:0.5:288:797
10/12/2009 05:00:07 PM - CMDPHP: Poller[0] Host[90] Description[HERS2004] DS[1388] Graphs['HERS2004 - Disk I/O'] CMD: /usr/bin/php -q /var/www/cacti/scripts/wmi.php hers2004.brc.gbl credential Win32_PerfRawData_PerfDisk_LogicalDisk DiskWritesPersec,DiskWriteBytesPersec,DiskReadsPersec,DiskReadBytesPersec,CurrentDiskQueueLength Name C\:, output: CurrentDiskQueueLength:0 DiskReadBytesPersec:5856099328 DiskReadsPersec:405102 DiskWriteBytesPersec:11258483712 DiskWritesPersec:493841

[chrisru]

Hey Claymen,

Firstly the wmi graphing is perfect, would it be hard to build data queries for these graphs? after having a look at how you would do that I got stuck because it appears the script needs to provide a couple of methods the first being a count query to just provide a count and the second seems to be for selecting results by index. Have you looked into this at all?